forked from OSchip/llvm-project
0ee176edc8
Some processors may speculatively execute the instructions immediately following RET (returns) and BR (indirect jumps), even though control flow should change unconditionally at these instructions. To avoid a potential miss-speculatively executed gadget after these instructions leaking secrets through side channels, this pass places a speculation barrier immediately after every RET and BR instruction. Since these barriers are never on the correct, architectural execution path, performance overhead of this is expected to be low. On targets that implement that Armv8.0-SB Speculation Barrier extension, a single SB instruction is emitted that acts as a speculation barrier. On other targets, a DSB SYS followed by a ISB is emitted to act as a speculation barrier. These speculation barriers are implemented as pseudo instructions to avoid later passes to analyze them and potentially remove them. Even though currently LLVM does not produce BRAA/BRAB/BRAAZ/BRABZ instructions, these are also mitigated by the pass and tested through a MIR test. The mitigation is off by default and can be enabled by the harden-sls-retbr subtarget feature. Differential Revision: https://reviews.llvm.org/D81400 |
||
|---|---|---|
| .. | ||
| AArch64 | ||
| AMDGPU | ||
| ARC | ||
| ARM | ||
| AVR | ||
| BPF | ||
| Generic | ||
| Hexagon | ||
| Inputs | ||
| Lanai | ||
| MIR | ||
| MSP430 | ||
| Mips | ||
| NVPTX | ||
| PowerPC | ||
| RISCV | ||
| SPARC | ||
| SystemZ | ||
| Thumb | ||
| Thumb2 | ||
| VE | ||
| WebAssembly | ||
| WinCFGuard | ||
| WinEH | ||
| X86 | ||
| XCore | ||